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LISTING OF CLAIMS 

1-16. (cancelled). 

17. (new) An unauthorized-operation-judgment system for determining 
whether an operation received by a computer is an unauthorized operation, 
comprising: 

an operation-receiver for receiving instruction data for executing said 
operation; 

a first profile-creator for creating a first profile from said instruction data 
related to the operation for which instruction data was received by 
said computer; 

a first profile-storer for storing said first profile that was created by said 
first profile-creator; 

a second profile-creator for identifying a user that executed said operation 
by said instruction data, and creating a second profile related to the 
operation executed by said user; 

a second profile-storer for storing, according to user, said second profiles 
created by said second profile-creator; and 

a score-calculator for comparing said instruction data with at least one 
profile that is stored in said first profile-storer or in said second 
profile-storer, and calculating a score for determining whether said 
operation is an unauthorized operation. 

18. (new) The unauthorized-operation-judgment system of claim 17 
further comprising: 
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a first log-data-storer for storing log data of said computer; 
and 

a second log-data-storer for storing log data according to a user of said 
computer; 

wherein 

said first profile-creator references said first log-data-storer when creating 
said first profile; and 

said second profile-creator references said second log-data-storer when 
creating said second profile. 

19. (new) The unauthorized-operation-judgment system of claim 17 
further comprising: 

a login-detector for executing a process for detecting whether a certain 
user is logged into said computer; 

wherein 

when said login-detector detects that a certain user is logged in, said 

second profile-creator creates a second profile related to said user. 

20. (new) The unauthorized-operation-judgment system of claim 19, 
wherein said login-detector executes detection processing at specified intervals 
while said computer is in operation. 

21. (new) The unauthorized-operation-judgment system of claim 19, 
wherein when said login-detector does not detect that a certain user is logged in 
even though detection processing is executed, said first profile-creator creates a 
first profile related to said computer. 
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22. (new) The unauthorized-operation-judgment system of claim 21 , 
wherein said login-detector executes detection processing at specified intervals 
while said computer is in operation. 

23. (new) The unauthorized-operation-judgment system of claim 17 
further comprising: 

a third profile-creator for creating a third profile related to an operation 
executed by a user that is identified as a first-time user, when the 
user executing said operation by said instruction data is identified 
as a first-time user operating said computer for the first time; and 

a third profile-storer for storing third profiles that are created by said third 
profile-creator; 

wherein 

said score-calculator uses at least one profile that is stored in said third 
profile-storer instead of said second profile-storer to determine 
whether said operation is an unauthorized operation. 

24. (new) The unauthorized-operation-judgment system of claim 23 
further comprising: 

an operation-record-storer for storing, according to user, totals related to 
at least one of the following: number of logins to said computer, 
operation time that said computer has been operated, or number of 
days said computer has been operated; and 

a first-time-user-judgment mechanism for referencing said operation- 
record-storer, and determining that a user executing said operation 
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is a first-time user using said computer for the first time when said 
totals do not satisfy preset reference values; and 

wherein 

said third profile-creator creates a third profile for an operation executed 

by a user that is determined to be a first-time user by said first-time- 
user-judgment mechanism; and 

said score-calculator uses at least one profile stored in said third profile- 
storer when said first-time-user-judgment mechanism determines 
that a user is a first-time user to determine whether said operation 
is an unauthorized operation. 

25. (new) The unauthorized-operation-judgment system of claim 17, 
wherein 

said score-calculator calculates a score by calculating a deviation between 
said instruction data and data that is stored in said profiles. 

26. (new) The unauthorized-operation-judgment system of claim 17, 
further comprising: 

an operation-stopper for executing a process for stopping said operation 
when said score value exceeds a reference value. 

27. (new) The unauthorized-operation-judgment system of claim 17, 
further comprising: 

a warning-process for executing a process for displaying a warning on an 
operation screen of said computer, or generating a warning alarm 
on said computer, when said score exceeds a reference value. 
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28. (new) The unauthorized-operation-judgment system of claim 17, 
further comprising: 

a warning-notification-transmitter for sending a notification warning to an 

administration server operated by an administrator of said computer 
that there is a possibility of an unauthorized operation, when said 
score exceeds a reference value. 

29. (new) An unauthorized-operation-judgment method for determining 
whether an operation received by a computer is an unauthorized operation, 
comprising: 

receiving, by said computer, instruction data to execute said operation; 

creating, by said computer, a first profile related to the operation for which 
instruction data was received by said computer; 

storing, by said computer, said first profile in a first profile-storage unit; 

identifying, by said computer, a user that executed said operation by said 
instruction data; 

creating, by said computer, a second profile related to the operation 
executed by said user; 

storing, by said computer, said profile in a second profile-storage unit; 

comparing, by said computer, said instruction data with at least one profile 
that is stored in said first profile-storage unit or in said second 
profile-storage unit; and 

calculating a score for determining whether said operation is an 
unauthorized operation. 
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30. (new) An unauthorized-operation-judgment method for determining 
whether an operation received by a computer is an unauthorized operation, 
comprising: 

receiving, by said computer, instruction data for executing said operation; 

creating, by said computer, a first profile related to the operation for which 
said instruction data is received by said computer; 

sending, by said computer, said profile to a first profile-storage unit; 

identifying, by said computer, the user that executed said operation by 
said instruction data; 

creating, by said computer, a second profile related to the operation 
executed by said user; 

sending, by said computer, said profile to a second profile-storage unit; 

obtaining, by said computer, at least one profile from said first profile- 
storage unit or said second profile-storage unit; 

comparing, by said computer, said instruction data with said profile(s); and 

calculating, by said computer, a score for determining whether said 
operation is an unauthorized operation. 

31. (new) An unauthorized-operation-judgment program for determining 
whether an operation received by a computer is an unauthorized operation, 
comprising: 

software that receives instruction data for executing said operation, 

creates a first profile related to the operation for which instruction 
data was received by said computer, and stores said first profile in 
a first profile-storage unit; 

software that identifies the user that executed said operation by said 

instruction data, creating a second profile related to the operation 
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executed by said user and stores said profile in a second profile- 
storage unit; and 

software that compares said instruction data with at least one profile that 
is stored in said first profile-storage unit or in said second profile- 
storage unit, and calculates a score for determining whether said 
operation is an unauthorized operation. 

32. (new) An unauthorized-operation-judgment program for determining 
whether an operation received by a computer is an unauthorized operation, 
comprising: 

software that receives instruction data for executing said operation; 

software that creates a first profile related to the operation for which said 
instruction data is received by said computer, and sends said 
profile to a first profile-storage unit; 

software that identifies the user that executed said operation by said 

instruction data, creating a second profile related to the operation 
executed by said user, and sends said profile to a second profile- 
storage unit; and 

software that obtains at least one profile from said first profile-storage unit 
or said second profile-storage unit, comparing said instruction data 
with said profile(s), and calculating a score for determining whether 
said operation is an unauthorized operation. 
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